claude-tools-gateway
Claude Tools Native Gateway
한 줄 요약: 웹版 ChatGPT를 유일한 주체로 삼아, 로컬의 실제 Claude Code 네이티브 Session을 구동해 통제된 읽기·수정·검증·복구를 수행한다.
공개 저장소에는 소스 코드와 테스트만 포함되며, 로컬 키, Tunnel 설정 또는 state/ 세션 상태는 포함되지 않는다.
아키텍처
Gateway는 이제 Native V2 단일 실행 엔진만 사용한다:
当前 ChatGPT Chat(唯一主脑)
↔ Claude Tools Native MCP(六个 Session 控制工具)
↔ 本地模型回合桥(127.0.0.1)
↔ 隔离的 Claude Code 原生 Session
→ 原生 Agent loop
→ 网关自有的受控工具 ExecutorGateway가 MCP 초기화, 도구 목록, 호출 분배를 직접 수행하며, V1의 claude mcp serve 도구 서버를 시작하거나 프록시하지 않는다. Native Session을 생성한 후에만 해당 Session 전용 Claude Code 프로세스가 시작된다.
기존 V1 Agent Session, 최상위 Read/Edit/Write/Bash, 로컬 작업 도구, 기존 DeepSeek 위임, ChatGPT Bridge는 실행 진입점과 코드 트리에서 제거되었다. V2에서 여전히 필요한 공용 하위 인프라(원자적 상태 쓰기, 자격 증명 경로 보호, 프로세스 신원 인증, macOS 샌드박스 규칙)는 유지된다. 기존 V1 상태 파일은 자동으로 삭제되지 않지만, Native Gateway는 이를 읽거나 실행하지 않는다.
Related MCP server: localterminal-lite
MCP 제어면
웹版에는 여섯 개의 도구만 표시된다:
native_session_startnative_session_continuenative_session_recovernative_session_reply_and_waitnative_session_statusnative_session_stop
V1 도구 이름, 최상위 파일 도구, Bash, 기존 DeepSeek 도구 또는 기타 MCP 메서드는 도구 목록에서 숨기는 것에 그치지 않고 서버 측에서 거부된다.
Claude Code Session 기능
Session에는 세 가지 명확한 등급이 있으며, 생성 후에는 승격·강등하거나 루트 디렉터리를 변경할 수 없다:
read_only:Read,FindFiles,SearchText및 읽기 전용RunCommand; 읽기 범위는 컴퓨터 전체이며, 보호된 상태/자격 증명 경로와 macOS 권한은 제외된다.direct_write: 전체 컴퓨터 읽기 기능에Edit,Write,NotebookEdit이 추가되며, 사용자가 명시적으로 선택한 실제 디렉터리만 직접 수정한다. 사용자가 실제 파일 수정을 명시적으로 요청한 경우에만 이 등급을 선택해야 한다.worktree_write: 도구 세트는direct_write와 동일하지만, Gateway가 생성하고 유지하는 별도의 Git worktree만 수정하며 원본 checkout은 변경되지 않는다.
이들은 Claude Code 네이티브 Agent loop에서 모델이 호출할 수 있는 논리적 도구이지만, 실행자는 Gateway가 소유한다. 감독되지 않은 Claude Code 내장 파일 도구와 Bash는 계속 비활성화되어, 작업 승인·해시·복구·감사 원장을 우회하지 못하게 한다.
읽기 및 검색
Read는 컴퓨터의 보호되지 않은 일반 UTF-8 파일을 모두 읽을 수 있으며, 더 이상 쓰기 디렉터리에 제한되지 않는다.FindFiles는 임의의 절대 디렉터리에서 경계가 있는 파일 열거를 수행한다.SearchText는 UTF-8 리터럴 매칭만 수행하며 정규식이나 glob을 허용하지 않는다.검색은 심볼릭 링크를 따라가지 않으며,
.git, 보호된 경로, 외부 하드 링크를 건너뛴다.단일 검색 결과와 전체 작업 영수증은 64 KiB로 제한된다.
모든 등급에서 서로 다른 디스크와 디렉터리를 검사할 수 있다.
working_directory는 기본 검색 위치, 명령 CWD, 쓰기 등급의 쓰기 경계일 뿐이다. macOS TCC/파일 권한으로 인해 Desktop, Documents 또는 기타 시스템 보호 위치에 대한 접근이 여전히 거부될 수 있다.
파일 및 Notebook 수정
direct_write에서Edit,Write,NotebookEdit은 Session에 바인딩된 실제 디렉터리를 수정하고,worktree_write에서는 관리되는 worktree만 수정한다.Write는 승인된 루트 디렉터리 내에서 누락된 상위 디렉터리를 필요에 따라 생성한 후 대상 파일을 원자적으로 생성한다. 이를 통해 루트 디렉터리, 심볼릭 링크,.git또는 보호된 경로를 벗어날 수 없다.NotebookEdit은 cell ID 기준으로 셀 교체·삽입·삭제를 지원하지만 Notebook을 실행하지는 않는다.모든 쓰기 작업은 쓰기 전·후 SHA-256을 저장하며, 준비(prepare), CAS, 원자적 디스크 쓰기, 영속적 영수증을 사용한다.
프로세스 충돌 후 실제 파일 상태를 대조하며, 확실하지 않으면 복구를 중단하고 맹목적으로 재쓰기하지 않는다.
direct_write에는 파일 삭제 도구가 없으며, 읽기 전용 검사 명령 때문에 파일을 쓰지 않는다. 사용자의 명시적 지시에 따라 대상 파일을 덮어쓰거나 수정할 수는 있다.worktree_write에서 원본 checkout의 파일, HEAD, tree, index, 작업 영역 상태는 변경되지 않는다. Git common dir에는 보존형 worktree가 등록된다.
검증 명령
RunCommand는 설치된 시스템 명령과 Session 디렉터리 내의 실행 파일을 허용하며, 정상적인 개발 도구를 오탐하는 정적 명령 화이트리스트는 더 이상 유지하지 않는다. 인수는 여전히 정확한 argv로 전달되며, Gateway가 자동으로 셸 문자열로 조합하지 않는다:
명령 관점에서 Session 루트 파일 시스템은 읽기 전용이다;
네트워크, 프로세스 시그널, Keychain/XPC, 모델 CLI는 macOS Seatbelt로 차단된다;
sudo, 직접 삭제/이동, 시스템 제어,find -delete/-exec,rg --pre, 모델 CLI 등의 진입점은 여전히 명시적으로 거부된다;일반 프로젝트의 심볼릭 링크, 하드 링크 또는 파일 수가 많아도 명령이 시작 전에 전체 저장소가 거부되지는 않는다. 실제 접근 시 Seatbelt, 보호된 경로, macOS 권한으로 제약된다;
출력, 실행 시간, 자식 프로세스 그룹 회수에 모두 경계가 있다;
결과는 먼저 동일한 작업 원장에 들어간 후 다음 GPT 턴에 전달된다.
이는 신뢰할 수 있는 저장소 검증을 위한 것이며, 동일한 macOS 계정의 악성 프로세스에 대항하는 컨테이너가 아니다. Session 실행 중에는 다른 편집기나 프로세스로 관리되는 worktree를 동시에 수정하지 말아야 한다.
메인 모델, 웹 검색 및 DeepSeek
메인 라우팅은 chatgpt-main으로 고정되며, model, provider, endpoint, API key 또는 fallback 인수를 받지 않는다. 현재 ChatGPT 턴이 중지되면 Claude Code는 waiting_for_gpt에 머문다. Claude, DeepSeek 또는 Codex로 임의 전환하여 계속 사고하지 않는다.
웹 검색은 계속 웹版 ChatGPT가 수행한다. Claude Code의 WebSearch/WebFetch는 열리지 않으므로, GPT 검색과 Claude 자체 검색이 충돌하거나 출처가 통제 불능이 되는 일이 없다.
기본 subagent_policy: "none"이며 DeepSeek을 생성하지 않는다. worktree_write에서 명시적으로 deepseek_explicit을 선택한 경우에만 GPT가 메인 루프에서 다음을 사용할 수 있다:
deepseek_subagent_startdeepseek_subagent_getdeepseek_subagent_stop
위임은 먼저 메인 Session의 영속적 작업 원장에 들어간 후에야 격리된 하위 Session이 허용된다. 하위 작업 중 메인 Session은 Edit, Write, NotebookEdit, RunCommand를 동시에 실행하거나 두 번째 하위 작업을 시작할 수 없다. 라우팅은 Sonnet/Opus → Flash, Fable → Pro로 고정되며, 실패 시 Claude, Codex, OpenAI 또는 다른 등급의 DeepSeek으로 폴백하지 않는다.
Skill 컨텍스트
native_session_start는 ChatGPT가 명시적으로 선택한 최대 8개의 skill_contexts를 받을 수 있다. 이는 Claude Code 네이티브 Skill 런타임이 아니다:
검증된 지침 본문만 추출하여 고정한다;
스크립트, 리소스, 플러그인, Hook, Slash Command 또는 추가 도구는 로드하지 않는다;
각 허용 항목은 skill ID와 정규화된 전체
SKILL.md의 SHA-256을 함께 고정한다;최초 시작과 이후
resume은 동일한 영속 스냅샷을 사용한다;전체 본문은 0600 개인 상태와 현재 GPT에 필요한 모델 컨텍스트에만 나타난다.
허용 목록 예시:
CLAUDE_TOOLS_NATIVE_SKILL_ALLOWLIST_JSON='[{"skill_id":"personal:review","content_sha256":"<64位小写SHA-256>"}]' \
npm start해시는 UTF-8 BOM을 제거하고 CRLF/CR을 LF로 통일한 전체 텍스트 기준으로 계산된다.
격리 및 복구
각 Session은 독립된 HOME, Claude 설정 디렉터리, 실행 디렉터리, 프로세스 그룹을 사용한다.
Claude Code는
--bare, 빈 setting sources, 엄격한 MCP 설정, 정확한 도구 세트로 실행된다.메인 Claude 프로세스는 정확한 로컬 Broker/Executor 루프백 포트에만 접근할 수 있다.
자격 증명 디렉터리, Gateway 상태,
.git, 심볼릭 링크, 외부 하드 링크는 모두 fail closed이다. 일반 시스템/사용자 경로 접근 가능 여부는 Session 루트, macOS TCC, 파일 권한이 함께 결정한다.ChatGPT 응답과 각 승인된 작업은 먼저 원자적으로 디스크에 기록된 후 실행 중인 프로세스에 전달된다.
임대(lease) 만료 시 Runner를 중지하고 검사 가능한 상태를 남긴다.
Gateway 재시작은 Session에 속한 Runner를 죽이지 않는다.
native_session_recover는 소유권을 검증하고 임대를 순환시킨 후 동일한 Claude Code Session을 계속한다.Runner가 더 이상 존재하지 않으면 복구를 가장하지 않으며, 완료된 작업을 반복하지 않는다.
Claude Code 2.1.247에는 "Hooks만 활성화하면서 keychain, 플러그인, 자동 메모리는 계속 비활성화"하는 검증된 독립 스위치가 없으므로, 네이티브 Hooks, 네이티브 Skill/Slash, Agent, Workflow, Web 및 작업 원장의 감독을 받지 않는 타사 MCP는 계속 비활성화된다.
실행
npm startNative Gateway는 더 이상 CLAUDE_TOOLS_NATIVE_V2 또는 CLAUDE_TOOLS_NATIVE_V2_ONLY 스위치가 필요 없다. Native-only가 유일한 실행 모드다.
상태는 기본적으로 state/에 저장되며, 절대 경로 환경 변수 CLAUDE_TOOLS_STATE_DIR로 변경할 수 있다. Claude Code 기본 경로는 $HOME/.npm-global/bin/claude이며 CLAUDE_BIN으로 덮어쓸 수 있다.
장기 실행되는 Tunnel/Connector는 소스 코드 업데이트 후 재시작이 필요하다. ChatGPT가 연결된 도구 schema를 캐시할 수 있으므로, 새 세션에서 여섯 개의 native_session_*가 보이지 않으면 Claude Tools Connector를 새로 고치거나 다시 연결하라.
검증
npm test
npm run test:native:installed
npm run test:native:installed:write
npm run test:native:installed:direct-write
npm run test:native:installed:deepseek
npm run test:native:installed:skills자동 테스트가 다루는 범위:
Native-only MCP 직접 초기화, 정확한 여섯 도구, V1 도구 및 알 수 없는 메서드 거부;
턴과 작업 원장, 응답 멱등성, 임대, 프로세스 소유권, 중지와 복구;
Read/FindFiles/SearchText의 전체 컴퓨터 읽기, 보호된 경로, 크기, 정렬, 리터럴 매칭, 경합 경계;
Edit/Write/NotebookEdit의 direct 실제 디렉터리 쓰기, worktree 격리, CAS, 해시, 충돌 복구;
RunCommand의 관대한 개발 명령 진입점, Session 로컬 실행 파일, 읽기 전용 파일 시스템, 제로 네트워크, 민감 서비스 차단, 타임아웃 회수;
Skill의 ID/본문 해시 고정, start/resume 일관성, 개인 상태 경계;
DeepSeek 명시적 위임의 시작 장벽, 단일 작업 쓰기 잠금, 라우팅 검증, Gateway 재시작 복구, 중지;
공개 MCP/Session/history에 승인 ID, Runner token, PID, 내부 경로 또는 모델 자격 증명이 노출되지 않음.
Installed 테스트는 로컬 Claude Code 2.1.247과 localhost 스크립트 GPT를 사용하며 실제 모델에 연결하지 않는다:
test:native:installed:/를 읽기 전용 루트로 하여 FindFiles → 리터럴 SearchText → Read → final을 실행하고, Gateway 연결이 끊긴 후 동일한 Runner/Claude Session을 복구한다.test:native:installed:write: Read → Edit → Write → NotebookEdit → RunCommand → resume → Read.test:native:installed:direct-write: 동일한 실제 Claude Code 턴으로 테스트 픽스처의 실제 디렉터리를 직접 수정한 후 resume하여 영속 결과를 검증한다.test:native:installed:deepseek: 로컬 가짜 DeepSeek CLI로 명시적 위임, 결과 검증, 활성 쓰기 잠금, 재시작 복구, 중지를 검증한다.test:native:installed:skills: 해시가 고정된 두 개의 순수 지침 Skill이 start/resume에서 동일한 스냅샷을 사용하는지 검증한다.
이 로컬 스크립트 테스트는 실제 ChatGPT, Claude 또는 DeepSeek 모델 크레딧을 소모하지 않는다. 실제 DeepSeek 최소 스모크 테스트는 여전히 사용자의 별도 승인이 필요하다.
Available Tools
6 toolsnative_session_continueAIdempotent
Continue the same durable native Claude Code session without changing its immutable capability profile or filesystem root. ChatGPT remains the sole main model. A direct_write Session continues to address the same real directory; a worktree_write Session continues in its retained managed worktree. A Session created with deepseek_explicit may inspect or stop its explicitly started DeepSeek subagent; the subagent never takes over the main loop.
| Name | Required | Description | Default |
|---|---|---|---|
| prompt | Yes | New user prompt to continue the same native session. | |
| lease_id | Yes | Current lease id for the native session. | |
| wait_seconds | No | Seconds to wait for the next pending turn, from 0 to 50. Defaults to 30. | |
| idempotency_key | Yes | Stable retry id. Reusing it with different input is rejected. | |
| native_session_id | Yes | Native session id returned by native_session_start. |
Output Schema
| Name | Required | Description |
|---|---|---|
| route | Yes | |
| replay | Yes | |
| status | Yes | |
| fallback | Yes | |
| lease_id | Yes | |
| revision | Yes | |
| terminal | No | |
| workspace | Yes | |
| current_run | Yes | |
| last_result | No | |
| launch_error | No | |
| pending_turn | Yes | |
| stop_request | No | |
| session_label | Yes | |
| deepseek_route | Yes | |
| recovery_token | No | |
| skill_snapshot | Yes | |
| subagent_policy | Yes | |
| lease_expires_at | Yes | |
| network_boundary | Yes | |
| runtime_attached | Yes | |
| source_directory | Yes | |
| claude_session_id | Yes | |
| native_session_id | Yes | |
| recovery_required | Yes | |
| working_directory | Yes | |
| capability_profile | Yes | |
| deepseek_subsessions | Yes | |
| active_deepseek_subsession_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this as idempotent and non-destructive, and the description adds meaningful behavioral invariants: the capability profile and filesystem root stay unchanged, ChatGPT remains the sole main model, worktree behavior depends on session type, and a DeepSeek subagent cannot take over the main loop. These details go beyond what annotations or schema convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the core purpose, then adds behavior details about session types and the DeepSeek subagent. Each sentence contributes useful information, though the session-type sentences could be seen as elaborating what the first sentence already implies.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the 100% schema coverage, the presence of an output schema, and annotations covering idempotency and safety, the description supplies enough behavioral context for an agent to invoke the tool correctly. The only notable gap is the lack of explicit routing guidance against sibling continuation-related tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all five parameters thoroughly. The description adds high-level session context but does not add parameter-specific semantics beyond what is already present in the input schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the action: continue the same durable native session while preserving its capability profile, filesystem root, and main model. This distinguishes it from starting a new session, though it does not explicitly differentiate it from siblings like native_session_recover or native_session_reply_and_wait.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is for resuming an existing durable session rather than starting a new one, but it never explicitly names alternatives or states when to prefer this over native_session_recover or native_session_reply_and_wait. The guidance is contextual but not directive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
native_session_recoverBIdempotent
Reconnect ChatGPT to a durable native Claude Code session and rotate its lease. ChatGPT remains the sole main model. Any DeepSeek access remains limited to the Session's original explicit subagent policy; a write session is accepted only after its original direct directory or retained managed worktree binding is verified.
| Name | Required | Description | Default |
|---|---|---|---|
| recovery_id | Yes | Stable retry id for this recovery and lease rotation. | |
| wait_seconds | No | Seconds to wait for the recovered state or pending turn, from 0 to 50. Defaults to 0. | |
| recovery_token | Yes | Opaque recovery token returned when the native session was created. | |
| native_session_id | Yes | Native session id to recover. |
Output Schema
| Name | Required | Description |
|---|---|---|
| route | Yes | |
| replay | Yes | |
| status | Yes | |
| fallback | Yes | |
| lease_id | Yes | |
| revision | Yes | |
| terminal | No | |
| workspace | Yes | |
| current_run | Yes | |
| last_result | No | |
| launch_error | No | |
| pending_turn | Yes | |
| stop_request | No | |
| session_label | Yes | |
| deepseek_route | Yes | |
| recovery_token | No | |
| skill_snapshot | Yes | |
| subagent_policy | Yes | |
| lease_expires_at | Yes | |
| network_boundary | Yes | |
| runtime_attached | Yes | |
| source_directory | Yes | |
| claude_session_id | Yes | |
| native_session_id | Yes | |
| recovery_required | Yes | |
| working_directory | Yes | |
| capability_profile | Yes | |
| deepseek_subsessions | Yes | |
| active_deepseek_subsession_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already convey idempotency and non-destructiveness; the description adds meaningful context by stating that ChatGPT remains the sole main model, that DeepSeek access is limited by the original subagent policy, and that a write session requires verification of its directory or worktree binding. This goes beyond the annotations and helps an agent understand important constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is reasonably concise and front-loaded with the primary action. The second and third sentences add important behavioral constraints, though the third sentence is dense and slightly harder to parse. Overall, no sentence feels purely redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core purpose and key constraints, and the output schema likely handles return-value expectations. However, it lacks explicit usage guidance, does not differentiate from sibling tools, and does not state what happens when verification fails or the lease cannot be rotated. These are meaningful gaps for a recovery operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters. The description does not add parameter-level meaning beyond the schema, such as the relationship between wait_seconds and lease rotation or the origin of the recovery token. Per baseline for high schema coverage, a 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Reconnect ChatGPT to a durable native Claude Code session and rotate its lease.' This clearly conveys the core action. It does not explicitly name or contrast sibling tools, so it stops short of fully distinguishing itself from tools like native_session_continue.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus siblings such as native_session_continue, native_session_status, or native_session_reply_and_wait. The word 'Reconnect' loosely implies a recovery scenario, but no conditions, alternatives, or exclusions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
native_session_reply_and_waitADestructiveIdempotent
Submit ChatGPT's response for one exact pending native turn. ChatGPT is always the sole main model. Every profile permits bounded whole-computer Read, FindFiles, literal SearchText, and a network-blocked, filesystem-read-only RunCommand except on protected credential/state paths. direct_write permits gateway-authorized Edit, Write, and NotebookEdit only inside the selected real write root. worktree_write permits the same mutations only inside its retained managed worktree. A Session created with deepseek_explicit may additionally start, inspect, or stop one explicit DeepSeek subagent; start must be the only call in that response.
| Name | Required | Description | Default |
|---|---|---|---|
| text | No | Optional assistant text for this turn. | |
| turn_id | Yes | Pending turn id being answered. | |
| lease_id | Yes | Lease id returned by native_session_start. | |
| reply_id | Yes | Stable idempotency id for this reply. | |
| tool_calls | No | Optional gateway-authorized calls. The Session profile and fixed subagent policy decide which calls are accepted. DeepSeek start must be the sole call. Text plus all calls must stay within a 768 KiB aggregate reply budget. | |
| native_session_id | Yes | Native session id returned by native_session_start. |
Output Schema
| Name | Required | Description |
|---|---|---|
| route | Yes | |
| replay | Yes | |
| status | Yes | |
| fallback | Yes | |
| lease_id | Yes | |
| revision | Yes | |
| terminal | No | |
| workspace | Yes | |
| current_run | Yes | |
| last_result | No | |
| launch_error | No | |
| pending_turn | Yes | |
| stop_request | No | |
| session_label | Yes | |
| deepseek_route | Yes | |
| recovery_token | No | |
| skill_snapshot | Yes | |
| subagent_policy | Yes | |
| lease_expires_at | Yes | |
| network_boundary | Yes | |
| runtime_attached | Yes | |
| source_directory | Yes | |
| claude_session_id | Yes | |
| native_session_id | Yes | |
| recovery_required | Yes | |
| working_directory | Yes | |
| capability_profile | Yes | |
| deepseek_subsessions | Yes | |
| active_deepseek_subsession_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations mark the call as destructive and idempotent; the description adds substantial behavioral context by enumerating per-profile permissions (network-blocked read-only RunCommand, direct_write vs worktree_write roots) and the deepseek_explicit subagent exception. It does not explicitly describe the waiting/blocking behavior implied by the name, but the policy detail goes well beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is roughly 130 words and opens with the core action in the first sentence. Each following sentence covers a distinct policy area without significant redundancy, making it dense but not bloated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool this complex, the description covers the essential constraints: exact turn targeting, sole main-model ownership, per-profile permissions, and subagent limitations. The wait behavior is only hinted at by the tool name, and the description does not state what happens after submission, though an output schema exists to fill return-value gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds a useful summary of which tool_calls are permitted and restates the sole-call rule for DeepSeek start, but it does not individually explain native_session_id, lease_id, turn_id, or reply_id beyond what the schema already documents.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence states a specific action: 'Submit ChatGPT's response for one exact pending native turn.' It identifies the verb, the resource, and the exactness constraint, which clearly separates it from the session lifecycle siblings. The 'ChatGPT is always the sole main model' line further clarifies its role in the session.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the required condition—'one exact pending native turn'—and gives operational rules for tool_calls, such as 'DeepSeek start must be the only call.' However, it never explicitly contrasts this tool with siblings like native_session_continue or states when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
native_session_startAIdempotent
Start an isolated native Claude Code session with the current ChatGPT conversation as the sole main model. subagent_policy defaults to none. All profiles may use Read, FindFiles, literal SearchText, and a network-blocked, filesystem-read-only RunCommand across the computer except protected credential/state paths. working_directory remains the command CWD and, for write profiles, the only write root. read_only never writes. When the user explicitly asks to modify the actual files in working_directory, choose direct_write; it works for Git and non-Git directories. Choose worktree_write only for an isolated copy of a clean Git repository. deepseek_explicit remains available only with worktree_write; DeepSeek never becomes the main model.
| Name | Required | Description | Default |
|---|---|---|---|
| prompt | Yes | Task to start in the native session. | |
| wait_seconds | No | Seconds to wait for the first pending turn, from 0 to 50. Defaults to 30. | |
| session_label | No | Optional short label for the owning ChatGPT conversation. | |
| skill_contexts | No | Optional explicit, allowlisted SKILL.md contexts selected by ChatGPT for this immutable Session. They add instructions only and cannot grant tools or change providers. | |
| idempotency_key | Yes | Stable retry id. Reusing it with different input is rejected. | |
| subagent_policy | No | Optional subagent boundary. Defaults to none. deepseek_explicit requires worktree_write; ChatGPT remains the sole main model. | |
| working_directory | Yes | Absolute command CWD and write root. Read, FindFiles, and SearchText may inspect other absolute paths across the computer except protected state/credential paths. direct_write modifies this directory in place and does not require Git. worktree_write requires the clean top level of a Git repository. | |
| capability_profile | No | Execution boundary. Defaults to read_only. If the user explicitly requested in-place changes to actual files, use direct_write, including for non-Git directories. Use worktree_write only when an isolated retained copy of a clean Git repository is desired. |
Output Schema
| Name | Required | Description |
|---|---|---|
| route | Yes | |
| replay | Yes | |
| status | Yes | |
| fallback | Yes | |
| lease_id | Yes | |
| revision | Yes | |
| terminal | No | |
| workspace | Yes | |
| current_run | Yes | |
| last_result | No | |
| launch_error | No | |
| pending_turn | Yes | |
| stop_request | No | |
| session_label | Yes | |
| deepseek_route | Yes | |
| recovery_token | No | |
| skill_snapshot | Yes | |
| subagent_policy | Yes | |
| lease_expires_at | Yes | |
| network_boundary | Yes | |
| runtime_attached | Yes | |
| source_directory | Yes | |
| claude_session_id | Yes | |
| native_session_id | Yes | |
| recovery_required | Yes | |
| working_directory | Yes | |
| capability_profile | Yes | |
| deepseek_subsessions | Yes | |
| active_deepseek_subsession_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With annotations already marking idempotentHint=true and destructiveHint=false, the description adds rich behavioral context: isolated session, subagent_policy default, restricted tool capabilities (network-blocked, filesystem-read-only RunCommand), protected credential/state paths, working_directory as the only write root for write profiles, and read_only never writes. This gives the agent a clear model of side effects and boundaries.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose in the first sentence and every subsequent sentence carries meaningful constraint information. It is a dense paragraph rather than structured bullets, and a couple of details (subagent_policy defaults to none) duplicate the schema, but it is appropriately concise for a tool with this many behavior-affecting choices.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich input schema, output schema, and annotations, the description covers all invocation-critical decisions: profile selection, subagent policy, working directory semantics, tool restrictions, and write behavior. Nothing needed to call the tool correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds useful decision semantics on top: capability_profile selection guidance (read_only never writes, direct_write works for Git/non-Git, worktree_write only for clean Git), the write-root constraint, and the deepseek_explicit-worktree coupling. Some of this duplicates schema text, but 'only write root' and 'read_only never writes' add meaning beyond the param descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence states the exact action: start an isolated native Claude Code session with the current ChatGPT conversation as sole main model. This is a specific verb + resource and distinguishes native_session_start from the continue/recover/reply_and_wait/status/stop siblings by the 'start' action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly tells when to choose direct_write (explicit user request to modify actual files, Git or non-Git) and worktree_write (isolated copy of a clean Git repo), and ties deepseek_explicit to worktree_write. It does not explicitly name sibling tools or state when to use start over continue/recover, so it falls short of full alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
native_session_statusARead-onlyIdempotent
Read native-session state without advancing it or invoking a model. ChatGPT remains the sole main model. Safe summaries of any explicitly enabled DeepSeek subagent and the retained managed-worktree location are returned when present.
| Name | Required | Description | Default |
|---|---|---|---|
| lease_id | Yes | Lease id returned by native_session_start. | |
| wait_seconds | No | Seconds to wait for a state change, from 0 to 50. Defaults to 0. | |
| native_session_id | Yes | Native session id returned by native_session_start. |
Output Schema
| Name | Required | Description |
|---|---|---|
| route | Yes | |
| replay | Yes | |
| status | Yes | |
| fallback | Yes | |
| lease_id | Yes | |
| revision | Yes | |
| terminal | No | |
| workspace | Yes | |
| current_run | Yes | |
| last_result | No | |
| launch_error | No | |
| pending_turn | Yes | |
| stop_request | No | |
| session_label | Yes | |
| deepseek_route | Yes | |
| recovery_token | No | |
| skill_snapshot | Yes | |
| subagent_policy | Yes | |
| lease_expires_at | Yes | |
| network_boundary | Yes | |
| runtime_attached | Yes | |
| source_directory | Yes | |
| claude_session_id | Yes | |
| native_session_id | Yes | |
| recovery_required | Yes | |
| working_directory | Yes | |
| capability_profile | Yes | |
| deepseek_subsessions | Yes | |
| active_deepseek_subsession_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and non-destructive behavior, and the description adds meaningful context beyond those flags: it explicitly states no session advancement and no model invocation, and clarifies that only safe summaries of enabled DeepSeek subagents and the managed-worktree location are returned. This substantially helps an agent predict side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The most decision-relevant facts—reading state, not advancing, not invoking a model—are front-loaded, and the second sentence adds precise return-value context without unnecessary length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema, 100% parameter coverage, and annotations that already define safety characteristics, the description supplies the remaining context an agent needs: the tool is side-effect-free, returns safe summaries when present, and preserves ChatGPT as the sole main model. Nothing essential is missing for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents all parameter meanings. The description does not add significant parameter-level detail beyond what the schema provides, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') with a clear resource ('native-session state') and adds a key distinguisher: the operation does not advance the session or invoke a model. It also names exactly what information is returned, making the tool's purpose unmistakable relative to its siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'without advancing it or invoking a model' clearly establishes this as a non-mutating status-check tool, implying use when state is needed without side effects. It does not explicitly name alternatives like native_session_continue, so there is some room for inference, but the intended context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
native_session_stopADestructiveIdempotent
Stop the isolated native-session process and preserve durable state and any managed worktree for inspection. ChatGPT remains the sole main model. Any active Session-owned DeepSeek subagent must be safely stopped and durably observed before the Session can finalize.
| Name | Required | Description | Default |
|---|---|---|---|
| reason | No | Optional concise reason for stopping the session. | |
| lease_id | Yes | Lease id returned by native_session_start. | |
| request_id | Yes | Stable retry id for this stop request. | |
| native_session_id | Yes | Native session id returned by native_session_start. |
Output Schema
| Name | Required | Description |
|---|---|---|
| route | Yes | |
| replay | Yes | |
| status | Yes | |
| fallback | Yes | |
| lease_id | Yes | |
| revision | Yes | |
| terminal | No | |
| workspace | Yes | |
| current_run | Yes | |
| last_result | No | |
| launch_error | No | |
| pending_turn | Yes | |
| stop_request | No | |
| session_label | Yes | |
| deepseek_route | Yes | |
| recovery_token | No | |
| skill_snapshot | Yes | |
| subagent_policy | Yes | |
| lease_expires_at | Yes | |
| network_boundary | Yes | |
| runtime_attached | Yes | |
| source_directory | Yes | |
| claude_session_id | Yes | |
| native_session_id | Yes | |
| recovery_required | Yes | |
| working_directory | Yes | |
| capability_profile | Yes | |
| deepseek_subsessions | Yes | |
| active_deepseek_subsession_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint and idempotentHint, but the description adds valuable context: durable state and worktree are preserved for inspection, the main ChatGPT model is untouched, and Session-owned DeepSeek subagents must be safely stopped. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the primary action. The second sentence about ChatGPT remaining the sole main model is slightly tangential but adds context; overall every sentence is short and purposeful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core purpose, a prerequisite, and the side-effect guarantee of preservation. With a full output schema and complete parameter schema, nothing critical is missing; retry semantics are already implied by the idempotentHint annotation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline of 3 applies. The description itself does not add meaning beyond the schema, but each parameter is already fully documented in the schema with origin, format, and purpose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: it stops the isolated native-session process and preserves durable state and managed worktree for inspection. It also clarifies the tool's relationship to the main model, making the action unambiguous. This clearly distinguishes it from the sibling start/continue/recover/status tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when the tool should be used by stating that active subagents must be safely stopped and durably observed 'before the Session can finalize.' However, it does not explicitly name alternative tools or give explicit when-not-to-use guidance, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.8.0- First observed
native_session_continue - First observed
native_session_recover - First observed
native_session_reply_and_wait - First observed
native_session_start - First observed
native_session_status - First observed
native_session_stop
TDQS
Scored across 6 tools
Each tool maps to a distinct lifecycle action such as start, continue, recover, reply, status, or stop. The only mild ambiguity is between continue and recover, since both involve reconnecting to an existing session, though the descriptions differentiate them by lease rotation and capability immutability.
All tool names follow the same native_session_ prefix with an imperative verb or verb phrase. The naming pattern is uniform and predictable, making the tool set easy to navigate.
Six tools is well-scoped for a session gateway: creation, continuation, recovery, interaction, status inspection, and shutdown. Each tool has a clear role without redundancy.
The tool set covers the full lifecycle of a native session: start it, continue or recover it, send replies, check status, and stop it. Stop preserves durable state rather than losing it, so the workflows do not end in a dead end.
Maintenance
Related MCP Connectors
Use your Mac, Windows or Linux computer from ChatGPT, Claude or Codex: files, commands, documents.
Work on your own computers from Claude or ChatGPT: run commands, edit and search files.
Safe folder access for ChatGPT and Claude: read, write and search files, risky tools opt-in.
Persistent cross-session memory shared by Codex, Claude Code, ChatGPT, and other AI agents.
Related MCP Servers
- AlicenseAqualityCmaintenanceProvides comprehensive session management for Claude Code with automatic initialization/cleanup, quality checkpoints, and local conversation memory with semantic search for capturing learnings across coding sessions.6452 PyPI4BSD 3-Clause
- AlicenseNot gradedqualityBmaintenanceBridges ChatGPT with local computer for controlled file and project management, featuring session-based collaboration and diff tracking.4Apache 2.0
- AlicenseNot gradedqualityCmaintenanceBridges Claude Code terminal sessions with Claude Chat by exposing session logs as tools, enabling seamless context transfer and two-way communication via a cooperative inbox and optional Google Drive sync.36 npm1MIT
- AlicenseNot gradedqualityBmaintenanceA secure, local-first MCP coding and computer-use harness for ChatGPT and Codex, enabling guarded file operations, durable terminals, Git review, local skills, and macOS computer control.142 npmMIT